key-custodian/src

@oktoid/key-custodian: signing keys and wrapping keys that never leave their token.

The port (KeyCustodian), its one adapter over PKCS#11 (createPkcs11KeyCustodian), the key policy that keeps known software tokens out of production and holds production to the token it procured, and the configuration block that wires them. The deployables that hold keys import it (credential, and from slice 3 agent and audit); it carries a native module, which is why it is not part of common, and why @oktoid/key-wrap reaches the wrapping family through a structural type instead of depending on this package.